Preev.com compromised? Script injection ?

[Kprawn]

I get script injection problems with Preev.com .... Could someone verify if this site might be compromised with a bad script? I have no problems with other sites.

I have counter measures in place for script injection attacks, but the warning flags are being raised for Preev.com. Please double check this for me, and correct me if I am wrong.

The site could have been compromised without the owner knowing it. 

[pedrog]

Virustotal.com doesn't detect anything.

[rammy2k2]

all good here too

[teddy5145]

Fine on me too
Maybe it was false alarm ?
Or maybe it was coming you pc did you try to check your pc ?

[butcherboss]

I dont think there is any problem. My pc does not show anything. Scan your pc for virus maybe it was your pc or maybe you ended up on a wrong site made just like preev.com

[Kprawn]

I debugged the code and it seems to inject this script :

http://hidcptqmerifcusymaqddcomolsujibeptsmycmqsrwgrcmywshgnfpjhcc.com/filter.aspx?partner=910345&f=popup-u  --> DO NOT CLICK ON THIS LINK <----

<script src="http://hidcptqmerifcusymaqddcomolsujibeptsmycmqsrwgrcmywshgnfpjhcc.com/filter.aspx?partner=910345&amp;f=popup-u"></script>

There is definitely something strange going on... 

[mexxer-2]

http://hidcptqmerifcusymaqddcomolsujibeptsmycmqsrwgrcmywshgnfpjhcc.com/filter.aspx?partner=910345&f=popup-u  --> DO NOT CLICK ON THIS LINK <---

I'm good at not following warnings so I opened the link, in a VPS though. And it seems to redirect to google adwords if you do not insert the showme.html part, and if you do, it redirects to a youtube video

[Pollak]

I use FF no script. The only scripts loading are
Google Analytics and some jquery.

On which location did you find the script?

[Kprawn]

I use FF no script. The only scripts loading are
Google Analytics and some jquery.

On which location did you find the script?

It could be a secondary script, injecting it with every visit to the site. I am going to do a quick re-image to restore everything to it's default status, but I would like to determine

where the infection / hack is coming from. No need doing a whole re-image and you cannot identify the exploited site. It will just re-inject the script and continue as normal.

I have APP's in place to stop the payload, but it disables key features on some of the sites and cancel it's functionality.  ... I guess it's back to VM.